Malicious npm Packages Targeting Red Hat Cloud Services Steal Credentials

Jun 1, 2026 · Original article ↗

Summary

Socket reports compromised @redhat-cloud-services npm packages that run an obfuscated payload during installation, harvest credentials and CI secrets, and exfiltrate data. The article details the malware’s behavior and recommends exposure review, containment, and secret

Key points

Affected package versions run a malicious loader through an npm preinstall hook, so execution can occur during installation without importing the package.
The loader decrypts and executes staged payloads, downloads Bun when needed, and may detach into a background process on non-CI systems.
The malware is designed to collect GitHub Actions secrets, npm tokens, cloud and Kubernetes credentials, SSH keys, Git credentials, and other sensitive files.
It can exfiltrate encrypted data over HTTPS or use the GitHub API to commit encrypted result files.
Socket says attribution is unclear, noting that publicly available Shai-Hulud tooling lowers the barrier to similar operations.
Organizations that installed affected versions should investigate developer machines and CI/CD systems, contain potentially affected hosts, remove malicious versions, and rotate accessible credentials.

Article Details

Attack Vectors: Compromised @redhat-cloud-services npm package versions execute an obfuscated JavaScript loader through a preinstall hook during npm installation.
The loader decrypts embedded payloads at runtime, stages the main payload in a randomized temporary file, and executes it with Bun; the temporary file is then deleted.
The payload collects environment variables, tokens, credentials, sensitive files, and GitHub Actions runner secrets, and can run as a detached background process on non-CI systems.
Collected data is encrypted and sent by HTTPS POST to a decoded endpoint; a fallback can commit encrypted results to GitHub repositories using a stolen token.
The package code can download Bun and includes logic to process repositories and modify GitHub repository or workflow files. Campaign attribution is unclear.
Defensive Notes: Treat systems that installed affected package versions as potentially compromised; isolate affected developer hosts, suspend affected CI runs, and rebuild from clean environments where feasible.
Remove affected versions, verify replacement package metadata and provenance, and clear package caches that may contain affected tarballs.
Rotate credentials accessible to affected processes, including GitHub and npm tokens, cloud credentials, Kubernetes and Vault tokens, SSH keys, Git credentials, and CI/CD secrets.
Audit GitHub and npm activity for unexpected package releases, repository or workflow changes, Contents API writes, and files matching results-<timestamp>-<counter>.json.
Inspect for randomized /tmp/p*.js payloads, /tmp/b-* Bun extraction directories, b.zip, unexpected Bun binaries, and tmp.0987654321.lock.
Restrict GitHub Actions token permissions, reduce secrets exposed to dependency installation, enforce dependency controls, and monitor unexpected network egress and runtime downloads.

Indicators of compromise

Type	Indicator	Context
SHA256	`0dc06ecdaa63fe24859cfd955053c23245c536e4733480239d14bebf12688e35`	SHA-256 of the decrypted main payload.
SHA256	`21b6409a7b84446310daca5409ad6112ac60a1e4bef97736e53fff5f63bfdef4`	SHA-256 of the malicious package/index.js loader.
SHA256	`88896d478986d453f5da79b311de39d9b4b1bea95c21af1d8ef181b0f4e52fe9`	SHA-256 of the affected @redhat-cloud-services_chrome-2.3.1.tar.gz package artifact.
SHA256	`ac2a2208e1726e008be6c73dc0872d9bba163319259dff1b62055ac933ca46b6`	SHA-256 of the decrypted Bun helper.
SHA256	`ee262510cb246d2b904991aee7fc61162bdae34463439ec6383bd5356479d362`	SHA-256 of the affected package/package.json file.
URL	`hxxps[:]//api[.]anthropic[.]com/v1/api`	Decoded endpoint used by the payload for encrypted outbound data transfer; Socket does not assess the domain as threat actor-owned.